PIX 506E problem accessing Internet after hours

Posted on 2006-10-24
Last Modified: 2010-04-09
I configured PIX 506E restricted device (R-pix-506E-BUN-K9) did not know that Pix 506E has restricted version.
My Story IS!!

I configured the 506E and all users could access the internet and receive and send email as well 2 days ago but yesterday the users could not access the internet.Spoke to ISP and they confirmed that the link was fine. I tested with an old 3com firewall router and it works fine.
I have looked at the fixup and could not find a fixup DNS entry, I tried to put in the command but it won't take it with error " Bad protocol dns".
I am held up hear at this point dont know what has happened.
Any kind of help will be appreciated.
Do i need to activate the Device ?
"Show vers" command shows that its been activated.
My worry is that it worked for some 2 days.
My sample config is below.

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password encrypted
passwd  encrypted
hostname LA-FW
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
access-list acl_in permit tcp any host X.X.182.153 eq smtp
access-list 102 permit ip
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside X.X.182.153
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool
pdm location inside
pdm location outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 102
nat (inside) 1 0 0
static (inside,outside) tcp X.X.182.153 smtp smtp netmask 255.255
.255.255 0 0
access-group acl_in in interface outside
route outside X.X.182.158 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server partnerauth protocol radius
aaa-server partnerauth (inside) host un1v3rs1ty timeout 5
http server enable
http inside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt ipsec pl-compatible
crypto ipsec transform-set strongdes esp-3des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set strongdes
crypto map partner-map 10 ipsec-isakmp dynamic dynmap
crypto map partner-map client authentication partnerauth
crypto map partner-map interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 3600
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup LA address-pool ippool
vpngroup LA dns-server
vpngroup LA wins-server
vpngroup LA idle-time 1800
vpngroup LA password
telnet inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
: end

Can some one look at my config to identify why this is happening. Basically when I move the connection to a 3com firewall for 30min and connect  back the pix506 it starts working again.
When i do the "show int" command i get the below output.

interface ethernet0 "outside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.bd3c.02eb
  IP address X.X.182.153, subnet mask
  MTU 1500 bytes, BW 10000 Kbit half duplex
        304669 packets input, 241369008 bytes, 0 no buffer
        Received 463 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        274255 packets output, 122942548 bytes, 0 underruns
        0 output errors, 4327 collisions, 0 interface resets
        0 babbles, 0 late collisions, 1701 deferred
        1 lost carrier, 0 no carrier
        input queue (curr/max blocks): hardware (128/128) software (0/2)
        output queue (curr/max blocks): hardware (0/26) software (0/3)
interface ethernet1 "inside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.bd3c.02ec
  IP address, subnet mask
  MTU 1500 bytes, BW 100000 Kbit full duplex
        309339 packets input, 121496564 bytes, 0 no buffer
        Received 31047 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        300447 packets output, 234414434 bytes, 0 underruns
        0 output errors, 0 collisions, 0 interface resets
        0 babbles, 0 late collisions, 0 deferred
        1 lost carrier, 0 no carrier

I changed the cable from the DSL router to a cross cable and it worked for about 12hrs and stopped allowing users access to the internet but all emails work fine.

Can someone HELP PLEASE!!!?
Question by:afamm
  • 5
  • 4
LVL 79

Expert Comment

ID: 17796947
>PIX Version 6.3(1)
Does not support dns fixup. You'd have to upgrade to 6.3(5)

There's nothing wrong with the config. If it was a configuration issue it either works or not. If it worked for 12 hours then stops, then it is something else.

Pix is running at half duplex
 MTU 1500 bytes, BW 10000 Kbit half duplex
I see collision counters on the interface, which is expected if both devices are set to half-duplex. Pix is set to auto, and might not be negotiating properly with the DSL router/modem.
What exactly are you connecting the outside interface to? A DSL modem? It could be a duplex mismatch between the DSL and the PIX. You could put a small switch in between them and see if that clears it up.

Author Comment

ID: 17797032
the outside interface is connected to an SDSL modem and the port says 10baseT.
what kind of switch. Can you give me a sample switch that i couls use please?
LVL 79

Expert Comment

ID: 17797266
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.


Author Comment

ID: 17797994
The SDSL modem that i have has four 10baset ports and a cross cable connected from one of the SDSL ports to  the Eternet0 pix 506 interface and from the Ethernet1 of the Pix506 a cable connected to a Netgear Gigabite switch GS748T.
I have also gone ahead to change the ethernet0 port command on the Pix to 10baset (ie. interface ethernet0 10baset)and it runnung on a half duplex connection speed.
The netgear is an autosensing switch and does not have a direct conection with the switch.
Please let me know what you think.


LVL 79

Expert Comment

ID: 17798110
If it's a 4-port switch on the back of the DSL modem, then a crossover cable would not be needed. Suggest going back to straight-through cable.

Author Comment

ID: 17801780
Clients are complaining that they cannot get through to some websites.
Any command that will allow these access please?

Author Comment

ID: 17802261
Also what command would i use for a half duplex connection on the pix?
LVL 79

Accepted Solution

lrmoore earned 500 total points
ID: 17802680
interface ethernet0 10baset
LVL 79

Expert Comment

ID: 17830859

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco VPN client v5 migration to Anyconnect VPN? 8 52
ASA DHCP setup 5 38
Cisco 3650 switch 7 46
Changing VLAN information 3 16
If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question